github.com/fjballest/golang@v0.0.0-20151209143359-e4c5fe594ca8/src/syscall/exec_linux_test.go (about) 1 // Copyright 2015 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 // +build linux 6 7 package syscall_test 8 9 import ( 10 "io/ioutil" 11 "os" 12 "os/exec" 13 "strings" 14 "syscall" 15 "testing" 16 ) 17 18 // Check if we are in a chroot by checking if the inode of / is 19 // different from 2 (there is no better test available to non-root on 20 // linux). 21 func isChrooted(t *testing.T) bool { 22 root, err := os.Stat("/") 23 if err != nil { 24 t.Fatalf("cannot stat /: %v", err) 25 } 26 return root.Sys().(*syscall.Stat_t).Ino != 2 27 } 28 29 func whoamiCmd(t *testing.T, uid, gid int, setgroups bool) *exec.Cmd { 30 if _, err := os.Stat("/proc/self/ns/user"); err != nil { 31 if os.IsNotExist(err) { 32 t.Skip("kernel doesn't support user namespaces") 33 } 34 t.Fatalf("Failed to stat /proc/self/ns/user: %v", err) 35 } 36 if isChrooted(t) { 37 // create_user_ns in the kernel (see 38 // https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/kernel/user_namespace.c) 39 // forbids the creation of user namespaces when chrooted. 40 t.Skip("cannot create user namespaces when chrooted") 41 } 42 // On some systems, there is a sysctl setting. 43 if os.Getuid() != 0 { 44 data, errRead := ioutil.ReadFile("/proc/sys/kernel/unprivileged_userns_clone") 45 if errRead == nil && data[0] == '0' { 46 t.Skip("kernel prohibits user namespace in unprivileged process") 47 } 48 } 49 // When running under the Go continuous build, skip tests for 50 // now when under Kubernetes. (where things are root but not quite) 51 // Both of these are our own environment variables. 52 // See Issue 12815. 53 if os.Getenv("GO_BUILDER_NAME") != "" && os.Getenv("IN_KUBERNETES") == "1" { 54 t.Skip("skipping test on Kubernetes-based builders; see Issue 12815") 55 } 56 cmd := exec.Command("whoami") 57 cmd.SysProcAttr = &syscall.SysProcAttr{ 58 Cloneflags: syscall.CLONE_NEWUSER, 59 UidMappings: []syscall.SysProcIDMap{ 60 {ContainerID: 0, HostID: uid, Size: 1}, 61 }, 62 GidMappings: []syscall.SysProcIDMap{ 63 {ContainerID: 0, HostID: gid, Size: 1}, 64 }, 65 GidMappingsEnableSetgroups: setgroups, 66 } 67 return cmd 68 } 69 70 func testNEWUSERRemap(t *testing.T, uid, gid int, setgroups bool) { 71 cmd := whoamiCmd(t, uid, gid, setgroups) 72 out, err := cmd.CombinedOutput() 73 if err != nil { 74 t.Fatalf("Cmd failed with err %v, output: %s", err, out) 75 } 76 sout := strings.TrimSpace(string(out)) 77 want := "root" 78 if sout != want { 79 t.Fatalf("whoami = %q; want %q", out, want) 80 } 81 } 82 83 func TestCloneNEWUSERAndRemapRootDisableSetgroups(t *testing.T) { 84 if os.Getuid() != 0 { 85 t.Skip("skipping root only test") 86 } 87 testNEWUSERRemap(t, 0, 0, false) 88 } 89 90 func TestCloneNEWUSERAndRemapRootEnableSetgroups(t *testing.T) { 91 if os.Getuid() != 0 { 92 t.Skip("skipping root only test") 93 } 94 testNEWUSERRemap(t, 0, 0, false) 95 } 96 97 func TestCloneNEWUSERAndRemapNoRootDisableSetgroups(t *testing.T) { 98 if os.Getuid() == 0 { 99 t.Skip("skipping unprivileged user only test") 100 } 101 testNEWUSERRemap(t, os.Getuid(), os.Getgid(), false) 102 } 103 104 func TestCloneNEWUSERAndRemapNoRootSetgroupsEnableSetgroups(t *testing.T) { 105 if os.Getuid() == 0 { 106 t.Skip("skipping unprivileged user only test") 107 } 108 cmd := whoamiCmd(t, os.Getuid(), os.Getgid(), true) 109 err := cmd.Run() 110 if err == nil { 111 t.Skip("probably old kernel without security fix") 112 } 113 if !os.IsPermission(err) { 114 t.Fatalf("Unprivileged gid_map rewriting with GidMappingsEnableSetgroups must fail") 115 } 116 } 117 118 func TestEmptyCredGroupsDisableSetgroups(t *testing.T) { 119 cmd := whoamiCmd(t, os.Getuid(), os.Getgid(), false) 120 cmd.SysProcAttr.Credential = &syscall.Credential{} 121 if err := cmd.Run(); err != nil { 122 t.Fatal(err) 123 } 124 }